Feeling Lucky
?
[#10775] - Security issue: a user with access to User Manager can change his own user group
- Closed
- 10 Jun 2016
- Medium
- Build: master
- # 10775
Steps to reproduce the issue
Create a subgroup of administrator
for example "testgroup"
Deny some permissions for that group, for example Create, Edit, etc. (anything for the sake of the demonstration) globally or for any component.
Log with a user member of the "testgroup"
Go to User Manager, edit the user, change his group to Administrator
Expected result
One should have an error stating that a user can't change group
Actual result
The user can make himself administrator...
Additional comments
brianteeman
- | Labels |
Added:
?
|
||
| Category | ⇒ | ACL |
| Status | New | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2016-06-10 10:42:57 |
| Closed_By | ⇒ | infograf768 | |
| Build | master | ⇒ | staging |
| Labels |
Added:
?
|
||
Closing as we have a patch
#10776
This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/10775.